Write a review

Head to head · Identity verification · October 2026 research run

Alloy vs Shufti

Shufti scores 57.8 (C) on agent readiness against Alloy's 52.4 (D), and leads in 4 of 7 scored categories. Alloy leads on schema & documentation and agent ergonomics. Both do identity verification.

Best identity and business verification APIs for AI agents · All 119 verification comparisons

AlloyFirst Mile Group, Inc. (Alloy) · HTTP API D52.4/100#782 of 1076 ShuftiShufti Pro Limited · HTTP API C57.8/100#631 of 1076

Which one, for what

Alloy D

Best for Banks and fintechs that already run onboarding through Alloy and want an agent to submit journey applications, read decisions and work investigations.

Ahead on

  • Schema & documentation, 73 against 58
  • Agent ergonomics, 52 against 47

Watch for

No public prices, trial or self-serve sign-up. Access starts with a demo request

Shufti C

Best for A team that wants document, face, address, AML and KYB checks behind one endpoint, a free plan for low volume, and an MCP server that hands the person a hosted verification link.

Ahead on

  • Reliability, 65 against 59
  • Security & auth, 62 against 49
  • Payments & pricing, 35 against 0
  • Transparency & trust, 71 against 62

Also in its favour

  • A hosted endpoint, with nothing to install
  • Free to start without a card

Watch for

No OpenAPI file or other machine-readable contract was found. The reference is prose tables plus Postman collections

Score by category

CategoryWeight this runAlloyShuftiEdge
Reliability16%205965Shufti +6
Performance10%pendingpendingpendingnot scored in this run
Schema & documentation13%16.27358Alloy +15
Agent ergonomics13%16.25247Alloy +5
Security & auth14%17.54962Shufti +13
Payments & pricing10%12.5035Shufti +35
Task success10%pendingpendingpendingnot scored in this run
Maintenance & community7%8.87272even
Transparency & trust7%8.86271Shufti +9
Negative events≤1500
TotalD 52.4/100C 57.8/100

Facts side by side

FactAlloyShufti
KindHTTP APIHTTP API
VendorFirst Mile Group, Inc. (Alloy)Shufti Pro Limited
Hosted endpointno (local only)https://api.shuftipro.com
TransportsHTTPHTTP, Streamable HTTP
AuthOAuth or keyOAuth or key
PricingPaidFreemium
x402nono
LicenceProprietary service under Alloy's terms of service. The @alloyidentity/web-sdk capture package is MITProprietary service under Shufti's Terms and Conditions. The licences of the mobile capture SDKs were not checked
Tools exposednone25
Read-only variant documentednono
llms.txtyesyes
Last release2026-10-052026-10-06
Terms last updated2026-03-12
Privacy policy last updatedno date given2026-09-01
Customer content may train modelsnot found in the textyes, with an opt-out
Terms restrict automated accessyes
Terms restrict benchmarkingnot found in the text
Terms or service can change without noticenot found in the text
Arbitration or class-action waiveryes
Popularity21k npm/wk673 npm/wk

Verdicts

Alloy

Alloy's public docs cover journeys, evaluations, entities, documents, cases and investigations, with llms.txt, Markdown pages, OpenAPI fragments and rate-limit headers with retry-after. Access is sales-led with no public price or trial, credentials have no scopes, there is no idempotency key or server SDK, and inputs vary by each customer's workflow.

Shufti

One endpoint covers document, face, address, AML and KYB checks, with a free plan of 10 verifications a month, and a hosted MCP server adds OAuth with three scopes. No OpenAPI file, server SDK or idempotency key was found, and the status page history could not be read.

Before you call either

Alloy

  1. Get the account's base URL from the customer. Defaults are api.alloy.co and sandbox.alloy.co, and some accounts have their own hosts
  2. Use unique, prefixed external IDs in sandbox. Sandbox and Production share one data store
  3. Read alloy-ratelimit-remaining, and on 429 or 5xx wait for retry-after with exponential backoff and jitter
  4. Expect running after about 25 seconds on journey applications and wait for the webhook instead of resubmitting
  5. Send the workflow header with account-level keys, since inputs depend on the workflow configured

Shufti

  1. POST every verification to https://api.shuftipro.com/ with a unique reference of 6 to 250 characters and one object per service. Read results from /status with that reference
  2. Register the callback domain in the back office first. An unregistered callback_url is rejected
  3. Stay under 60 requests a minute per IP on a production account and 20 on a trial account
  4. Check the Signature response header. Accounts created after 15 March 2023 hash the Secret Key with SHA-256 before appending it to the raw response
  5. Through MCP, identity checks return a verification_url for the person to open. No tool accepts an image, so use the REST API for offsite proofs

Questions

Which is better for AI agents, Alloy or Shufti?

Shufti scores 57.8 (C) on agent readiness against Alloy's 52.4 (D), and leads in 4 of 7 scored categories. Alloy leads on schema & documentation and agent ergonomics.

Do Alloy and Shufti need an API key?

Both take an API key or an OAuth sign-in.

Can an agent call Alloy and Shufti without installing anything?

No hosted endpoint is listed for Alloy. Shufti has a hosted endpoint at https://api.shuftipro.com.

Other comparisons with Alloy or Shufti

Machine-readable

For companies

Do agents find, use and choose your tools?

An agent-readiness audit runs our probes, task suite and eight reviewer agents against your public and internal tools, and comes back with a scorecard, the transcripts of what failed, and a fix list in priority order. From $2,500, re-run included. We never take payment to move a rank. We do help companies earn one.

Get an auditSee a sample report